Add LTI 1.1 configuration page to admin server

bnmnetp · claude · bnmnetp · commit 2d579e6d6e81 · 2026-07-07T15:34:05.000-05:00
Ports the legacy web2py LTI config panel (the #SetupLTI div in runestone/views/admin/admin.html) to a real page on the FastAPI admin server, replacing the "coming soon" placeholder in the instructor menu. - New GET /instructor/lti_config page plus create_lti_keys and delete_lti_keys endpoints. - create_lti1p1_config / fetch_lti1p1_config CRUD helpers (delete reuses the existing delete_lti_course). - lti_config.html + lti_config.js mirror the original panel: create / remove 1.1 keys, show/copy secret, and the LTI 1.3 remove-association button and option toggles (1.3 backend unchanged). - Instructor menu links directly to the new page. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NSYdBnh54WSQhG6Y4MAQ1x
diff --git a/bases/rsptx/admin_server_api/routers/instructor.py b/bases/rsptx/admin_server_api/routers/instructor.py
@@ -28,12 +28,15 @@
     create_course_attribute,
     create_instructor_course_entry,
     create_invoice_request,
+    create_lti1p1_config,
     create_membership,
     create_user_course_entry,
     delete_course_completely,
     delete_course_instructor,
+    delete_lti_course,
     delete_user_course_entry,
     fetch_all_course_attributes,
+    fetch_lti1p1_config,
     fetch_assignment_questions,
     fetch_assignments,
     fetch_available_students_for_instructor_add,
@@ -431,6 +434,83 @@ async def get_course_settings(
     return templates.TemplateResponse("admin/instructor/course_settings.html", context)
 
 
+@router.get("/lti_config")
+@instructor_role_required()
+@with_course()
+async def get_lti_config(
+    request: Request,
+    user=Depends(auth_manager),
+    response_class=HTMLResponse,
+    course=None,
+):
+    """
+    Display the LTI integration configuration page.  Handles LTI 1.1 key/secret
+    management (the LTI 1.3 pieces are configured elsewhere and are only surfaced
+    here for informational purposes and to allow removing an association).
+    """
+    templates = Jinja2Templates(directory=template_folder)
+
+    lti_key = await fetch_lti1p1_config(course.id)
+    course_attrs = await fetch_all_course_attributes(course.id)
+
+    context = {
+        "course": course,
+        "user": user,
+        "request": request,
+        "is_instructor": True,
+        "student_page": False,
+        "settings": settings,
+        "consumer": lti_key.consumer if lti_key else "",
+        "secret": lti_key.secret if lti_key else "",
+        "ignore_lti_dates": course_attrs.get("ignore_lti_dates") == "true",
+        "no_lti_auto_grade_update": course_attrs.get("no_lti_auto_grade_update")
+        == "true",
+    }
+
+    return templates.TemplateResponse("admin/instructor/lti_config.html", context)
+
+
+@router.post("/create_lti_keys")
+@instructor_role_required()
+@with_course()
+async def post_create_lti_keys(
+    request: Request,
+    user=Depends(auth_manager),
+    course=None,
+):
+    """
+    Generate an LTI 1.1 consumer key and secret for this course and store them.
+    Triggered from the LTI configuration page.
+    """
+    existing = await fetch_lti1p1_config(course.id)
+    if existing:
+        return JSONResponse(
+            content={"consumer": existing.consumer, "secret": existing.secret}
+        )
+
+    lti_key = await create_lti1p1_config(course.course_name, course.id)
+    return JSONResponse(
+        content={"consumer": lti_key.consumer, "secret": lti_key.secret}
+    )
+
+
+@router.post("/delete_lti_keys")
+@instructor_role_required()
+@with_course()
+async def post_delete_lti_keys(
+    request: Request,
+    user=Depends(auth_manager),
+    course=None,
+):
+    """
+    Remove the LTI 1.1 consumer key and secret for this course.
+    Triggered from the LTI configuration page.
+    """
+    if await fetch_lti1p1_config(course.id):
+        await delete_lti_course(course.id)
+    return make_json_response(status=status.HTTP_200_OK, detail={"status": "success"})
+
+
 # Assessment Reset Model
 class AssessmentResetRequest(BaseModel):
     student_username: str
diff --git a/components/rsptx/db/crud/__init__.py b/components/rsptx/db/crud/__init__.py
@@ -139,9 +139,11 @@
 # import all functions from .lti by name
 from .lti import (
     create_lti_course,
+    create_lti1p1_config,
     delete_lti_course,
     delete_lti1p3_course,
     fetch_lti_version,
+    fetch_lti1p1_config,
     fetch_lti1p3_assignments_by_rs_assignment_id,
     fetch_lti1p3_assignments_by_rs_course_id,
     fetch_lti1p3_config_by_lti_data,
@@ -339,9 +341,11 @@
 
 __all__ += [
     "create_lti_course",
+    "create_lti1p1_config",
     "delete_lti_course",
     "delete_lti1p3_course",
     "fetch_lti_version",
+    "fetch_lti1p1_config",
     "fetch_lti1p3_assignments_by_rs_assignment_id",
     "fetch_lti1p3_assignments_by_rs_course_id",
     "fetch_lti1p3_config_by_lti_data",
diff --git a/components/rsptx/db/crud/lti.py b/components/rsptx/db/crud/lti.py
@@ -1,3 +1,4 @@
+import uuid
 from typing import List, Optional
 from rsptx.configuration import settings
 from pydal.validators import CRYPT
@@ -413,6 +414,43 @@ async def create_lti_course(course_id: int, lti_id: str) -> CourseLtiMap:
     return new_entry
 
 
+async def fetch_lti1p1_config(course_id: int) -> Optional[LtiKey]:
+    """
+    Fetch the LTI 1.1 key/secret associated with a course, if any.
+
+    :param course_id: int, the id of the course
+    :return: Optional[LtiKey], the LtiKey record for the course or None
+    """
+    query = (
+        select(LtiKey)
+        .join(CourseLtiMap, CourseLtiMap.lti_id == LtiKey.id)
+        .where(CourseLtiMap.course_id == course_id)
+    )
+    async with async_session() as session:
+        res = await session.execute(query)
+        return res.scalars().first()
+
+
+async def create_lti1p1_config(course_name: str, course_id: int) -> LtiKey:
+    """
+    Generate an LTI 1.1 consumer key and secret, store them, and associate them
+    with the given course.  There is no real magic about the keys so a UUID is
+    just as good a solution as anything.
+
+    :param course_name: str, the name of the course (used to build the consumer key)
+    :param course_id: int, the id of the course
+    :return: LtiKey, the newly created LtiKey record
+    """
+    consumer = f"{course_name}-{uuid.uuid1()}"
+    secret = str(uuid.uuid4())
+    new_key = LtiKey(consumer=consumer, secret=secret, application="runestone")
+    async with async_session.begin() as session:
+        session.add(new_key)
+        await session.flush()
+        session.add(CourseLtiMap(course_id=course_id, lti_id=new_key.id))
+    return new_key
+
+
 async def delete_lti_course(course_id: int) -> bool:
     """
     Delete a course from the LTI map.
diff --git a/components/rsptx/templates/admin/instructor/lti_config.html b/components/rsptx/templates/admin/instructor/lti_config.html
@@ -0,0 +1,119 @@
+{% extends "admin/_admin_base.html" %}
+
+{% block title %}
+LTI Configuration
+{% endblock %}
+
+{% block content %}
+<div class="admin-page admin-page--narrow lti-config">
+    <a href="/admin/instructor/menu" class="back-link">Back to Instructor Dashboard</a>
+
+    <div class="page-header">
+        <h1>LTI Configuration</h1>
+    </div>
+
+    <div class="course-info">
+        <h3>{{ course.course_name }}</h3>
+        <p>Base Course: {{ course.base_course }}</p>
+    </div>
+
+    <div id="alert-container"></div>
+
+    <div class="panel">
+        <p>LTI is <strong>Community Supported!</strong> It works with various LMS platforms (Canvas, Sakai,
+            Moodle, and Desire2Learn) but you need to know how to configure things on your own LMS. There are
+            two different LTI configurations available: LTI 1.1 (traditional) and LTI 1.3. LTI 1.1 can be
+            configured by the instructor. LTI 1.3 requires the LMS admin to configure the tool, but is more
+            secure and has more features.</p>
+
+        <p>Please <a href="https://guide.runestone.academy/managing-your-course.html#lti_integration"
+                rel="noopener noreferrer" target="_blank">read the docs</a> first, then feel free to ask for
+            help on the <code>#lti_community_support</code> channel on Discord. If you have it working on
+            another LMS please help us out and contribute to the docs so that others can benefit.</p>
+    </div>
+
+    <div class="panel">
+        <h2>LTI 1.1 Integration</h2>
+        <p>To launch LTI on Runestone use <code>https://runestone.academy/runestone/lti</code></p>
+        <p>You will need to generate a key and secret that will be used to communicate with the LMS. (See
+            <a href="https://guide.runestone.academy/managing-your-course.html#lti_integration"
+                rel="noopener noreferrer" target="_blank">the docs</a>.)</p>
+
+        <div class="lti-actions">
+            <button id="create_lti" class="btn btn-primary" onclick="generateLTIKeys()"
+                {% if consumer %}disabled{% endif %}>Create LTI Key and Secret</button>
+            <button id="delete_lti" class="btn btn-danger" onclick="deleteLTIKeys()"
+                {% if not consumer %}disabled{% endif %}>Remove LTI Key and Secret</button>
+        </div>
+
+        <table class="lti-keys-table">
+            <tr>
+                <th>Consumer Key:</th>
+                <td>
+                    <span id="ckey_value">{{ consumer }}</span>
+                    <a class="copy-link" title="Copy" onclick="copyElementToClipboard('ckey_value')">&#128203;</a>
+                </td>
+            </tr>
+            <tr>
+                <th>Secret:</th>
+                <td>
+                    <span id="secret_value" data-secret="{{ secret }}">{% if secret %}&bull;&bull;&bull;&bull;&bull;&bull;&bull;&bull;{% endif %}</span>
+                    <button type="button" class="btn btn-sm" id="show_secret" onclick="toggleSecret()"
+                        {% if not secret %}disabled{% endif %}>Show Secret</button>
+                    <a class="copy-link" title="Copy" onclick="copySecretToClipboard()">&#128203;</a>
+                </td>
+            </tr>
+        </table>
+    </div>
+
+    <div class="panel">
+        <h2>LTI 1.3 Integration</h2>
+        <p>Your LMS administrator will need to configure Runestone as a tool available on your LMS. This will
+            only need to happen one time for your LMS. Once it is configured you can use the tool in any course
+            you have on Runestone. Point them to
+            <a href="https://guide.runestone.academy/managing-your-course.html#lti1p3_integration"
+                rel="noopener noreferrer" target="_blank">the Runestone LTI 1.3 documentation</a>. (This means
+            this integration is NOT available if you are using the free Canvas for Teachers or some other hosted
+            LMS that does not have a system administrator you can contact.)</p>
+
+        <p>Each Runestone course can only be linked to ONE LMS course via LTI 1.3. You can use multiple different
+            Runestone courses (to make use of multiple books) in one LMS course. If you need to disassociate this
+            Runestone course from any LTI links, you can do so by clicking the button below. Doing so will NOT
+            delete any assignments or grades in the LMS, but will remove the link between the two systems. You
+            can even relink the course to the same LMS course later if you need to.</p>
+
+        <div class="lti-actions">
+            <button id="delete_lti1p3" class="btn btn-danger" onclick="deleteLTI1p3()">Remove LTI 1.3
+                Association</button>
+        </div>
+
+        <h3>LTI 1.3 Options</h3>
+
+        <div class="settingsbox">
+            <div class="checkbox-container">
+                <input type="checkbox" id="ignore_lti_dates" {% if ignore_lti_dates %}checked{% endif %}
+                    onchange="updateCourse(this,'ignore_lti_dates')">
+                <label for="ignore_lti_dates">Ignore LTI 1.3 Date Changes</label>
+            </div>
+            <div class="setting-description">Runestone will try to update assignment due dates. Check to disable
+                automatic updates of assignment due dates from LMS assignment settings.</div>
+        </div>
+
+        <div class="settingsbox">
+            <div class="checkbox-container">
+                <input type="checkbox" id="no_lti_auto_grade_update"
+                    {% if no_lti_auto_grade_update %}checked{% endif %}
+                    onchange="updateCourse(this,'no_lti_auto_grade_update')">
+                <label for="no_lti_auto_grade_update">Do not auto update LTI grades</label>
+            </div>
+            <div class="setting-description">Runestone will try to update assignment scores in your LMS any time
+                a student completes a problem if that assignment's grades are set to released. Check this to
+                disable this behavior and only sync grades when you trigger it from the grading page.</div>
+        </div>
+    </div>
+</div>
+{% endblock %}
+
+{% block page_js %}
+<script src="/staticAssets/js/admin/lti_config.js"></script>
+{% endblock %}
diff --git a/components/rsptx/templates/admin/instructor/menu.html b/components/rsptx/templates/admin/instructor/menu.html
@@ -160,7 +160,7 @@ <h4>⚙️ Create a New Course</h4>
                     <h4>Manage API Tokens</h4>
                     <p>Add and manage API tokens for external services</p>
                 </a>
-                <a href="#" class="menu-item" onclick="showLTISetup()">
+                <a href="/admin/instructor/lti_config" class="menu-item">
                     <h4>Connect my Learning Management System</h4>
                     <p>Configure Learning Tools Interoperability settings</p>
                 </a>
diff --git a/components/rsptx/templates/staticAssets/css/admin.css b/components/rsptx/templates/staticAssets/css/admin.css
@@ -771,3 +771,60 @@ tr.duplicate {
         max-width: 300px;
     }
 }
+
+/* LTI configuration page (admin/instructor/lti_config.html) */
+.lti-config .panel {
+    margin-bottom: 20px;
+}
+
+.lti-config .panel h2 {
+    margin: 0 0 15px 0;
+    color: #333;
+    font-size: 1.4em;
+    padding-bottom: 10px;
+    border-bottom: 2px solid #4a90e2;
+}
+
+.lti-config .panel h3 {
+    text-align: left;
+    font-size: 1.15em;
+    border-bottom: none;
+    margin-top: 20px;
+}
+
+.lti-config .lti-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    margin: 15px 0;
+}
+
+.lti-config .btn-sm {
+    padding: 4px 10px;
+    font-size: 0.85em;
+}
+
+.lti-config .lti-keys-table {
+    width: 100%;
+    border-collapse: collapse;
+    margin-top: 10px;
+}
+
+.lti-config .lti-keys-table th {
+    text-align: left;
+    white-space: nowrap;
+    padding: 8px 12px 8px 0;
+    vertical-align: top;
+    width: 130px;
+}
+
+.lti-config .lti-keys-table td {
+    padding: 8px 0;
+    word-break: break-all;
+}
+
+.lti-config .copy-link {
+    cursor: pointer;
+    margin-left: 6px;
+    text-decoration: none;
+}
diff --git a/components/rsptx/templates/staticAssets/js/admin/lti_config.js b/components/rsptx/templates/staticAssets/js/admin/lti_config.js
diff --git a/components/rsptx/templates/staticAssets/js/admin/menu.js b/components/rsptx/templates/staticAssets/js/admin/menu.js
